RedHook Android RAT Abuses Wireless ADB via Accessibility Service to Gain Shell-Level Device Access

Key facts for RedHook RAT loopback ADB shell

Detection coverage for RedHook RAT loopback ADB shell

As of 2026-07-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1248 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: RedHook Loopback ADB Shell-UID-2000 Spawn Following Accessibility Grant (Shizuku-derived Privileged Server)

Detects a shell process at uid 2000 spawned from a loopback (127.0.0.1) adbd connection within 60 seconds of an Accessibility Service permission grant, followed by WRITE_SECURE_SETTINGS self-grant or silent package install/uninstall -- the post-exploitation signature of RedHook's Shizuku-derived privileged server (libmx.so).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1548, T1548.004, T1564, T1082
• Data sources: android_process_creation, mdm_telemetry, android_accessibility_grant_log
• Severity: critical
• Confidence: high

Splunk SPL

index=mdm sourcetype="android:process_creation" ParentProcess="adbd" ProcessUid=2000 ConnectionSource="127.0.0.1"
| eval spawn_time=_time
| join type=left device_id [ search index=mdm sourcetype="android:accessibility_grant" earliest=-2m@m
    | eval grant_time=_time | fields device_id, grant_time, package_name ]
| where (spawn_time - grant_time) <= 60 AND (spawn_time - grant_time) >= 0
| join type=left device_id [ search index=mdm sourcetype="android:permission_grant" permission="WRITE_SECURE_SETTINGS" grant_actor="self" OR sourcetype="android:pm_ops" (operation="install" OR operation="uninstall") silent=1
    | fields device_id, operation, permission ]
| stats count values(package_name) as accessibility_app values(operation) as pm_operations by device_id, ParentProcess, ProcessUid
| where count > 0

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "adbd"
| where AccountSid == "2000" or ProcessUid == "2000"
| where RemoteIP == "127.0.0.1" or InitiatingProcessRemoteIP == "127.0.0.1"
| join kind=inner (
    AndroidAccessibilityGrantEvents
    | where TimeGenerated > ago(24h)
    | project GrantTime = TimeGenerated, DeviceId, PackageName
) on DeviceId
| where Timestamp between (GrantTime .. (GrantTime + 60s))
| project Timestamp, DeviceId, PackageName, InitiatingProcessFileName, ProcessUid = "2000"
| summarize Count = count() by DeviceId, PackageName

Sigma

title: Loopback ADB Shell Spawned Immediately After Accessibility Service Grant
id: 3c7e9b41-8a2d-4f61-9c3e-2b1a4d5e6f70
status: experimental
description: Detects a shell process (uid 2000) spawned from a loopback adbd connection (127.0.0.1) within seconds of an Accessibility Service permission grant, matching RedHook's self-escalation chain via its embedded Shizuku-derived libmx.so client.
references:
    - https://www.group-ib.com/blog/redhook-android-rat-upgraded/
    - https://cybersecuritynews.com/redhook-android-rat-abuses-adb-wireless-debugging/
author: AII-Detector -- ThreadLinqs Intelligence
date: 2026-07-12
tags:
    - attack.privilege-escalation
    - attack.t1548
    - attack.t1548.004
    - attack.defense-evasion
    - attack.t1564
    - attack.tool.shizuku
logsource:
    product: android
    category: process_creation
detection:
    selection:
        ParentProcess: 'adbd'
        ProcessUid: 2000
        ConnectionSource: '127.0.0.1'
    timeframe: 60s
    condition: selection
falsepositives:
    - Legitimate developer use of the open-source Shizuku app, which uses the identical loopback-ADB shell-uid-2000 mechanism intentionally
    - Authorized MDM remote-support tooling that pairs over Wireless ADB with explicit user consent dialogs
level: critical

Known false positives:

• Legitimate Shizuku app usage by power users intentionally granting shell-level access to their own device
• Authorized remote-support MDM tooling pairing over Wireless ADB with an explicit user-confirmed dialog

Tuning notes: Cross-reference the spawning package against the legitimate Shizuku package name (moe.shizuku.privileged.api) and the org's MDM remote-support allowlist to reduce false positives; require the absence of a prior user-facing Wireless-Debugging-pairing confirmation dialog event to distinguish malicious self-pairing from legitimate pairing.

• 🔒 RedHook Fake Government/Bank APK Sideload from Phishing Distribution Chain · unlock with TL Creds
• 🔒 RedHook Anti-Kill Persistence Stack: Boot Restoration + Mutual Service Resurrection + OOM-Killer Exemption · unlock with TL Creds
• 🔒 RedHook Live Screen Streaming / RTMP Handoff Following Privileged Shell Escalation · unlock with TL Creds
• 🔒 RedHook Accessibility-Driven Runtime Permission Self-Grant (WRITE_SECURE_SETTINGS) · unlock with TL Creds
• 🔒 RedHook Silent Package Install/Uninstall via Privileged Shell (pm install/uninstall, No PlayStore Session) · unlock with TL Creds
• 🔒 RedHook Sensitive Data Exfiltration Chain: SMS, Contacts, Keylog and Screen/Camera Capture to Non-Allowlisted Domain · unlock with TL Creds
• 🔒 RedHook Accessibility Service Enables Developer Options / Wireless Debugging (MDM Telemetry) · unlock with TL Creds
• 🔒 RedHook C2 Beacon and Structured Exfil POSTs to App-Specific Endpoint Paths · unlock with TL Creds

Indicators of compromise for RedHook RAT loopback ADB shell

As of 2026-07-12, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-1248.

Sample indicators (3 of 29)

• Domain: 3n7wj[.]com
• URL: hxxps://nfe-bucketapk[.]s3[.]ap-southeast-1[.]amazonaws[.]com/SBV.apk
• File hash: 453333bffdd1850ea2e0647f7c805530b578919978a01b1e2be52d6eb2add946

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How RedHook RAT loopback ADB shell works

It supports 53 server-issued commands including screen streaming, keystroke interception, credential theft, and camera activation, and is distributed via social engineering impersonating government and financial institutions.

RedHook is an Android remote access trojan first documented by Cyble Research and Intelligence Labs in July 2025 as a banking trojan targeting Vietnamese users, distributed through phishing sites impersonating the State Bank of Vietnam (sbvhn[.]com), Sacombank, Central Power Corporation, the Traffic Police of Vietnam (CSGT), and the Vietnamese government. The original variant abused Accessibility Services and overlay permissions to harvest keystrokes, capture the screen via the MediaProjection API, and exfiltrate SMS, contacts, and banking credentials through a WebSocket-based RAT supporting 34 server-issued commands. APKs were hosted on an exposed AWS S3 bucket and CloudFront distribution; sequential user IDs in the leaked infrastructure suggested over 500 infected devices. Chinese-language strings in logs and leaked screenshots suggest a Chinese-speaking developer or operator.

In July 2026, Group-IB documented a significantly upgraded RedHook variant that is the first malware observed abusing Android's Wireless ADB (Wireless Debugging) feature to autonomously self-escalate privileges. Using its existing Accessibility Service foothold, the malware programmatically simulates the exact UI interactions a user would perform to enable Developer Options, activate Wireless Debugging, and pair itself as an authorized computer -- all invisibly, behind a full-screen overlay or fake system update dialog. It then launches an embedded ADB client (referenced internally as "libmx.so") that connects to the on-device adbd daemon over the loopback interface and spawns a privileged shell process at uid 2000 (the Android `shell` user). This shell-level access is functionally equivalent to what the legitimate open-source Shizuku framework provides to enthusiasts seeking elevated permissions without rooting; RedHook embeds Shizuku-derived logic to run a persistent privileged server that can grant itself additional runtime permissions, write to `Settings.Secure` (including `WRITE_SECURE_SETTINGS`), execute arbitrary shell commands, silently install/uninstall applications, and capture raw touch input -- all without further user prompts. This escalation path requires no root and no USB/OEM unlocking, working on any Android 11+ device that supports Wireless Debugging, which is the overwhelming majority of the current install base.

The command set has grown to 53 server-issued functions covering device reconnaissance, UI automation (taps, swipes, gestures, drags, long presses), notification bar access, contact/app/SMS harvesting, UI-layout (accessibility node tree) exfiltration, silent APK install/uninstall, text injection and navigation control, screen capture (screenshot and continuous streaming via WebSocket and, once privileged, RTMP), camera activation, device reboot, permission-check and grant primitives, fake system-update overlays, ADB-prompt dismissal automation, and OEM-specific routines tuned for Samsung, Xiaomi, Oppo, Vivo, Huawei, Meizu, and Google devices.

Persistence is achieved through a layered stack: a 1x1-pixel foreground activity that keeps the app foreground-classified even with the screen off; silent background audio playback via a MediaSession to win elevated OS process priority; a held WakeLock to defeat battery-optimization suspension; two mutually-monitoring internal services that relaunch each other via BIND_AUTO_CREATE if either is killed; a five-minute watchdog alarm that re-verifies service health; a BOOT_COMPLETED receiver for post-reboot restoration; and an oom_score_adj value of -1000 that exempts the process from Android's low-memory killer.

Distribution continues via social engineering: operators impersonate government officials or bank support staff over phone calls and messaging apps (Zalo is specifically documented), directing victims to fake Google Play Store replica sites to download a malicious APK. Targeting has expanded from Vietnam to Indonesia and the broader Southeast Asia region. C2 infrastructure for the 2026 variant uses the domain 3n7wj[.]com with dedicated API and WebSocket subdomains; the original 2025 campaign used iosgaxx423[.]xyz and jftxm[.]xyz infrastructure alongside AWS S3/CloudFront-hosted payloads.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1113 Screen Capture; T1125 Video Capture; T1636.003 Contact List; T1636.004 SMS Messages

Exfiltration

T1041 Exfiltration Over C2 Channel

Command and Control

T1071.001 Web Protocols; T1571 Non-Standard Port

Discovery

T1082 System Information Discovery; T1418 Software Discovery

execution

T1204.001 Malicious Link

collection

T1417 Input Capture

credential-access

T1417.002 GUI Input Capture

Persistence

T1541 Foreground Persistence; T1547 Boot or Logon Autostart Execution; T1624.001 Broadcast Receivers

Privilege Escalation

T1548 Abuse Elevation Control Mechanism; T1548.004 Elevated Execution with Prompt

Defense Evasion

T1564 Hide Artifacts

Impact

T1565 Data Manipulation

Resource Development

T1583.006 Web Services

Execution

T1623 Command and Scripting Interpreter

defense-evasion

T1629 Impair Defenses; T1655 Masquerading

initial-access

T1660 Phishing

Remediation for RedHook RAT loopback ADB shell

Patches

• No CVE / vendor patch applies -- this abuses legitimate Wireless ADB functionality rather than a vulnerability; Android OEMs could add a hardened confirmation step before Wireless Debugging pairing that Accessibility Services cannot programmatically bypass

Immediate actions

• Block C2 domains and subdomains: api.3n7wj[.]com, skt.3n7wj[.]com, sktv.3n7wj[.]com at DNS/perimeter
• Block legacy RedHook infrastructure: iosgaxx423[.]xyz, jftxm.xyz, sbvhn[.]com, mailisa[.]me, e13falsz.xyz
• Alert on outbound WebSocket connections to the above domains from mobile device management (MDM) egress
• Instruct users never to enable Wireless Debugging or Developer Options at the request of an app, phone call, or messaging-app prompt
• Uninstall APKs sideloaded from non-Play Store sources matching the SHA-256 IOCs listed

Workarounds

• Disable Developer Options entirely on non-developer end-user devices
• Restrict Accessibility Service permission grants to a vetted allowlist via enterprise mobility management
• Require biometric/PIN re-authentication before any Settings.Secure write, including Wireless Debugging toggles

Longer-term hardening

• Deploy Mobile Threat Defense (MTD) / EMM policies that alert on or block enablement of Developer Options and Wireless Debugging on managed devices
• Enforce Google Play Protect and block sideloading (unknown-sources installs) via MDM on corporate-enrolled Android devices
• Monitor for Accessibility Service grants to non-allowlisted applications via UEM/EMM
• User awareness training on government/bank impersonation via phone calls and messaging apps (Zalo and similar regional platforms)

Affected and fixed versions

• Google — Android OS
  Vulnerable versions: Android 11; Android 12; Android 13; Android 14; Android 15
• Samsung — Android devices (OEM-specific accessibility routines)
  Vulnerable versions: Android 11+
• Xiaomi — Android devices (OEM-specific accessibility routines)
  Vulnerable versions: Android 11+
• OPPO — Android devices (OEM-specific accessibility routines)
  Vulnerable versions: Android 11+
• Vivo — Android devices (OEM-specific accessibility routines)
  Vulnerable versions: Android 11+
• Huawei — Android devices (OEM-specific accessibility routines)
  Vulnerable versions: Android 11+
• Meizu — Android devices (OEM-specific accessibility routines)
  Vulnerable versions: Android 11+

Timeline of RedHook RAT loopback ADB shell

• 2024-11-01 AWS S3 bucket used to host locked-ioc-28 APK payloads (nfe-bucketapk.s3.ap-southeast-1.amazonaws[.]com) becomes active with operational logging data.
• 2025-01-01 First locked-ioc-28 malware samples observed in the wild targeting Vietnamese banking users.
• 2025-07-28 Cyble analysis of sequential user IDs found in the leaked/exposed AWS S3 operational data reveals that over 500 Android devices had likely been infected by the original locked-ioc-28 campaign at time of discovery.
• 2025-07-28 Cyble Research and Intelligence Labs publicly discloses the original locked-ioc-28 Android banking trojan, documenting 34 server-issued commands and phishing campaigns impersonating the locked-ioc-14, locked-ioc-26, and Vietnamese government agencies.
• 2026-07-09 Group-IB documents expansion of locked-ioc-28 targeting beyond Vietnam into Indonesia and the broader Southeast Asia region.
• 2026-07-09 Group-IB details locked-ioc-28's layered anti-kill persistence stack: a 1x1-pixel foreground activity, silent MediaSession audio playback, a held WakeLock, two mutually-resurrecting internal services bound via BIND_AUTO_CREATE, a five-minute watchdog alarm, a BOOT_COMPLETED receiver that restores shell-uid privileges within seconds of reboot, an oom_score_adj of -1000, and mlock()-based memory page pinning.
• 2026-07-09 Group-IB documents growth of locked-ioc-28's server-issued command set from 34 commands (2025 variant) to 53 commands (2026 variant), adding UI automation, ADB-prompt dismissal, RTMP-based privileged screen streaming, and OEM-specific routines.
• 2026-07-09 Group-IB publishes analysis of an upgraded locked-ioc-28 variant that is the first documented Android malware to abuse Wireless ADB (Wireless Debugging) for autonomous, root-free shell-level privilege escalation via embedded Shizuku-derived code, including the mechanism of simulating 7 taps on the build-number field to unlock Developer Options.
• 2026-07-12 BleepingComputer reports on the upgraded locked-ioc-28 Wireless ADB technique, summarizing the Group-IB findings for a wider security audience.

Sources cited for RedHook RAT loopback ADB shell

• RedHook Returns with a Dangerous Upgrade group-ib.com · Vendor report · 2026-07-09
• RedHook: A New Android Banking Trojan Targeting Users In Vietnam cyble.com · Research · 2025-07-28
• RedHook Android malware now uses Wireless ADB for shell access BleepingComputer · News · 2026-07-12
• RedHook Android RAT Abuses ADB Wireless Debugging to Gain Shell-Level Access cybersecuritynews.com · News · 2026-07-09
• RedHook Abuses Accessibility Service to Enable Developer Options and Wireless Debugging gbhackers.com · News · 2026-07-09
• Android RAT RedHook Uses Wireless ADB to Silently Grant Permissions and Control Devices cyberpress.org · News · 2026-07-09

Threats related to RedHook RAT loopback ADB shell

• RedHook Android RAT Abuses ADB Wireless Debugging and Embedded Shizuku Code for Non-Root Shell-Level Access (uid 2000)
• ToxicPanda 2.0 Android Banking Trojan Expands to 349 Financial Institutions Across 16 Countries

Previous and next in malware

• StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike Previous report